linux-kernel - Re: [PATCH v7] arm64: Work around Falkor erratum 1003

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 10 Feb 2017 09:56:10 +0000
From:   Catalin Marinas <catalin.marinas@....com>
To:     Christopher Covington <cov@...eaurora.org>
Cc:     Jonathan Corbet <corbet@....net>,
        Marc Zyngier <marc.zyngier@....com>,
        Will Deacon <will.deacon@....com>, linux-doc@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org,
        Mark Rutland <mark.rutland@....com>,
        linux-kernel@...r.kernel.org, shankerd@...eaurora.org,
        timur@...eaurora.org, sulrich@...eaurora.org,
        Jon Masters <jcm@...hat.com>,
        Neil Leeder <nleeder@...eaurora.org>,
        Mark Langsdorf <mlangsdo@...hat.com>,
        Mark Salter <msalter@...hat.com>
Subject: Re: [PATCH v7] arm64: Work around Falkor erratum 1003

On Wed, Feb 08, 2017 at 03:08:37PM -0500, Christopher Covington wrote:
> The Qualcomm Datacenter Technologies Falkor v1 CPU may allocate TLB entries
> using an incorrect ASID when TTBRx_EL1 is being updated. When the erratum
> is triggered, page table entries using the new translation table base
> address (BADDR) will be allocated into the TLB using the old ASID. All
> circumstances leading to the incorrect ASID being cached in the TLB arise
> when software writes TTBRx_EL1[ASID] and TTBRx_EL1[BADDR], a memory
> operation is in the process of performing a translation using the specific
> TTBRx_EL1 being written, and the memory operation uses a translation table
> descriptor designated as non-global. EL2 and EL3 code changing the EL1&0
> ASID is not subject to this erratum because hardware is prohibited from
> performing translations from an out-of-context translation regime.
> 
> Consider the following pseudo code.
> 
>   write new BADDR and ASID values to TTBRx_EL1
> 
> Replacing the above sequence with the one below will ensure that no TLB
> entries with an incorrect ASID are used by software.
> 
>   write reserved value to TTBRx_EL1[ASID]
>   ISB
>   write new value to TTBRx_EL1[BADDR]
>   ISB
>   write new value to TTBRx_EL1[ASID]
>   ISB
> 
> When the above sequence is used, page table entries using the new BADDR
> value may still be incorrectly allocated into the TLB using the reserved
> ASID. Yet this will not reduce functionality, since TLB entries incorrectly
> tagged with the reserved ASID will never be hit by a later instruction.
> 
> Based on work by Shanker Donthineni <shankerd@...eaurora.org>
> 
> Signed-off-by: Christopher Covington <cov@...eaurora.org>

Reviewed-by: Catalin Marinas <catalin.marinas@....com>